5cbe3686e0c67f8045745e46979df010_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

5cbe3686e0c67f8045745e46979df010_NeikiAnalytics.exe
Size

656KB
MD5

5cbe3686e0c67f8045745e46979df010
SHA1

7f61e0a3f4b1c5fbd2f913a49aec81d4e704564c
SHA256

1f9ea379a4200e41a266615f3ced091cb524382be05df4116b68c7b8538603bc
SHA512

2334a4f4ae81845b51cdcffc726c7729a7f0a696939936f0656f18dab090c9cf33d293ea8be06d1138f7d04d7d5af9d0dfe67dd108bbb1682153e9c341c5ce30
SSDEEP

12288:wxXM6TQHHpnL5JmPyYEQUaQjwYa6TqCVlDxVKebkiterUibMF71zT7:iM6TQHhL5QXYtTueYi0AibMF71

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5cbe3686e0c67f8045745e46979df010_NeikiAnalytics.exe

Files

5cbe3686e0c67f8045745e46979df010_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

593081750e50408a4864012ebf058745

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\workarea\8.98\drivers\2d\dal\extevents\polling\build\w32\B_rel\ati2evxx.pdb

Imports

kernel32

FlushFileBuffers
ConnectNamedPipe
CreateNamedPipeA
GetTickCount
LocalFree
LocalAlloc
OpenFile
GetLocalTime
Beep
GetPrivateProfileStringA
UnmapViewOfFile
OpenFileMappingA
MapViewOfFile
CreateFileMappingA
GetExitCodeThread
QueryPerformanceCounter
DisconnectNamedPipe
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
SetStdHandle
SetConsoleCtrlHandler
GetSystemInfo
VirtualProtect
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
ReadFile
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
GetCPInfo
GetOEMCP
OpenProcess
IsBadCodePtr
SetUnhandledExceptionFilter
InitializeCriticalSection
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
RaiseException
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
VirtualQuery
GetSystemDirectoryA
ExitThread
GetLocaleInfoA
InterlockedExchange
HeapSize
GetModuleHandleA
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
DeleteCriticalSection
GetStartupInfoA
GetCommandLineA
IsBadReadPtr
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentThread
CreateProcessA
SetThreadPriority
TerminateThread
GetCurrentProcess
WideCharToMultiByte
DeleteFileA
GetProcessHeap
HeapAlloc
HeapFree
GetCurrentProcessId
CreateSemaphoreA
InterlockedDecrement
InterlockedIncrement
PulseEvent
CreateMutexA
ReleaseSemaphore
DeviceIoControl
GetVersionExA
GetSystemPowerStatus
CreateThread
GetModuleFileNameA
GetExitCodeProcess
TerminateProcess
GetSystemTime
CreateFileA
SetFilePointer
WriteFile
ExitProcess
OpenMutexA
ReleaseMutex
OutputDebugStringA
CallNamedPipeA
GetProcAddress
FreeLibrary
LoadLibraryA
OpenEventA
SetEvent
WaitForMultipleObjects
WaitForSingleObject
CreateEventA
ResetEvent
Sleep
GetCurrentThreadId
GetLastError
GetACP
CloseHandle

user32

IsWindow
EnumDisplaySettingsA
KillTimer
UnregisterDeviceNotification
SendInput
EnumWindows
SendMessageA
GetPropA
RegisterWindowMessageA
RegisterHotKey
UnregisterHotKey
GetForegroundWindow
GetDesktopWindow
GetWindowThreadProcessId
RegisterDeviceNotificationA
ExitWindowsEx
SystemParametersInfoA
OpenDesktopA
CloseDesktop
SendNotifyMessageA
MsgWaitForMultipleObjects
GetCursorPos
MonitorFromPoint
GetMonitorInfoA
GetMessageA
DispatchMessageA
TranslateMessage
BroadcastSystemMessageA
DestroyWindow
DefWindowProcA
PostMessageA
FindWindowA
RegisterClassA
CreateWindowExA
ShowWindow
MessageBoxA
EnumDisplayDevicesA
ChangeDisplaySettingsExA
ChangeDisplaySettingsA
EnumDisplaySettingsExA
GetSystemMetrics
SetWindowPos
GetCursor
LoadCursorA
SetCursor
SetTimer

gdi32

DeleteDC
CreateDCA
ExtEscape

ole32

CoInitializeSecurity
CoUninitialize
CoInitializeEx
CoCreateInstance

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

userenv

LoadUserProfileA
GetUserProfileDirectoryW
UnloadUserProfile

psapi

GetModuleBaseNameA
EnumProcessModules
EnumProcesses

setupapi

SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiSetClassInstallParamsA
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInfoListDetailA
SetupDiGetClassDevsA
SetupDiOpenDevRegKey
CM_Get_Child_Ex
CM_Get_DevNode_Status
SetupDiGetDeviceInstanceIdA
CM_Reenumerate_DevNode
CM_Get_DevNode_Registry_PropertyA
CM_Get_Device_ID_ExA
CM_Get_Parent
SetupDiGetHwProfileList
SetupDiCallClassInstaller

advapi32

AllocateAndInitializeSid
InitializeAcl
AddAccessAllowedAce
FreeSid
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
RegisterServiceCtrlHandlerExA
DeleteService
CreateServiceA
RegCreateKeyA
CreateProcessAsUserA
SetServiceStatus
RegisterEventSourceA
ReportEventA
DeregisterEventSource
StartServiceA
RegSetValueExA
QueryServiceStatus
ImpersonateLoggedOnUser
RevertToSelf
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ControlService
RegDeleteValueA
RegOpenCurrentUser
RegCreateKeyExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegEnumValueA
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
GetLengthSid
OpenProcessToken
CheckTokenMembership
AdjustTokenPrivileges
LookupPrivilegeValueA
GetUserNameA
SetThreadToken
OpenThreadToken
SetSecurityDescriptorOwner

Sections

.text
Size: 452KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ecifead
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

593081750e50408a4864012ebf058745

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

ole32

oleaut32

userenv

psapi

setupapi

advapi32

Sections

.text Size: 452KB - Virtual size: 448KB

.rdata Size: 160KB - Virtual size: 158KB

.data Size: 8KB - Virtual size: 77KB

.rsrc Size: 32KB - Virtual size: 32KB

ecifead Size: - Virtual size: 4KB

.text
Size: 452KB - Virtual size: 448KB

.rdata
Size: 160KB - Virtual size: 158KB

.data
Size: 8KB - Virtual size: 77KB

.rsrc
Size: 32KB - Virtual size: 32KB

ecifead
Size: - Virtual size: 4KB